As director of safety, risk, regulation and planning for Dubai UAE’s Roads and Transport Authority (RTA), Amair Saleem has been at the center of applying a sophisticated and integrated risk management system across Dubai’s transportation infrastructure. His efforts at the RTA were recently recognized by the Institute of Risk Management, which named him the 2015 Global Risk Management Professional of the Year. Here, Mr. Saleem discusses how he has applied risk management processes and oversight to a number of complex systems with Fadi Sidani, a partner specializing in Enterprise Risk Services at Deloitte Middle East.

Fadi Sidani: What were some of the risk management practices that may have contributed to you being named Risk Management Professional of the Year by the Institute of Risk Management?

Amair Saleem: First, I believe they were impressed by the size of RTA’s operation. When people think of transport operators, they might think of a metro operator or bus operator. But the Dubai RTA oversees all surface public transportation, which includes a metro system, a tram system, buses, and taxis. In addition, it oversees road construction, water transport, and transport licensing service. We have over a million passenger journeys a day, which is significant considering Dubai’s population of approximately 2.2 million. In addition, the RTA is not only involved in the construction of transport, but also in the operation of varied services for the community. Another reason I think I received the award is that we are functioning at far broader scope and not at a purely operational risk environment level. We have put risk management as the RTA’s centralized engine to support management systems of the transport networks. To name but a few we have an asset management system, a project management system, a quality system, a health and safety system, a security system, a fraud system and an audit system. Risk management sits at the nexus or the hub of all of that and drives these other processes. If we don’t have a risk management system working effectively at the corporate level, the strategic level and the operation level, the RTA would be challenged. I think that’s why the Senior Management of RTA has put so much focus on developing a robust system that ties these aspects together and developing a risk culture.

Fadi Sidani: How do you oversee risk management across the varied transportation systems?

Amair Saleem: At a project level, we have a centralized project risk register. Depending on where the project is and the significance of the issue, we determine the depth at which we investigate a risk issue. I can use an example involving our railway systems. Although we have a corporate or enterprise risk management system, for something as critical as the rail system which includes a high degree of automation, it is important to understand the Crisis and Business Impact from the technology. This allows us to get operations up and running quickly should an issue arise. It also allows us to delve much deeper into the operational component of the system and to monitor more on a real-time basis than we could without that level of automation. The risk system also allows us to monitor at the level of component failure, such as subsystem failure, and how that would impact the overall system. From there we can see what may have caused a particular failure and what it would take for us to restore the service, from a business continuity perspective.

The basis of what I call the DNA for our approach to risk management is to combine project risk, operational risk and strategic risk together into one system. We fundamentally started with a project risk-based organization. So there was a level of risk management already ongoing, but then we added a lot more than just linking those separate systems together on the operational side. When you build a big transportation system, you can mitigate the majority of those risks from your design output and your manufacturing output, but you also will likely have residual operational risks. And those residual risks you need to mitigate in operations and particularly operation procedures that need to be monitored and addressed through software and other technological means.

Fadi Sidani: What were some of the challenges in implementing the risk management program as you envisioned it and what helped guide your decisions?

Amair Saleem: The learning curve was huge, especially the people element, involving operators and other employees. When you’re talking about so many employees and 40 departments and the diversity of services—from an operational rail agency type service to licensing and issuing of driving licenses— the distance and the scope of the risk management program are quite phenomenal. We felt that the people who could best identify the risks, considering the diversity of services, were those at the ground level, basically the department directors and department managers.

We held risk workshops with every department, and we added awareness sessions with junior management and senior management and even at the board level. And we got everyone, at all levels of the system, to start to think about risk in a direct way as how it influences their own operations, their projects and their reputation. That level of engagement helped smooth the transition to the new risk management system.

Because the risk management program is such a highly integrated system we also recognized that if we followed a typical process—doing our initial risk assessment, providing initial risk registers, and providing an all-working risk management system—the department directors and managers probably would have been reluctant to interact with it.

We decided to engage those employees early on using workshops and other vehicles, which presented challenges because we have about 25 to 30 different nationalities, with people from highly developed environments as well as many from less developed areas. So it was important to approach the project from a cultural perspective, including many different languages, as well as from a technical perspective. One of the key accomplishments was getting everyone to a common language of risk management at the organization.

Fadi Sidani: Looking forward, what’s next in terms of your plans for the RTA and risk management efforts?

Amair Saleem: We have a huge number of projects coming online because the Emirate of Dubai won the rights to host the World Expo 2020—this will enhance the scope of risk management in RTA.

We recently announced that we will be extending our metro line by another 15 kilometers. We’re looking at extending our tram line as well, and we’re expanding our transportation network, building new bridges and new roads. All of that project activity will be ongoing and represents a huge effort. At the same time, we’re operational. So we’re trying to balance what we have to do from the project sense while trying to balance the operational requirements, as well as the strategic corporate requirements.

We also are focusing on innovation. For example, we have set up an innovation laboratory at Dubai Tram facilities. We’re also looking at smart applications and processes to update our management and enterprise risk management systems, and RTA now provides 173 services through its nine smart applications. One of these smart application will enable staff members to raise a risk issue, which then gets moved into a central database. As guided by the Director General of RTA, innovation has been a big part of our plan for the RTA for some time, and our focus on innovation will play an even more important role as the transport authority grows in size and complexity.

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see About Deloitte to learn more about our global network of member firms.